Foreign PLMN GUTI and SUCI Management

Foreign PLMN GUTI and SUCI management

A foreign PLMN GUTI and SUCI management feature is a network control method that

  • allows operators to configure acceptance or rejection of registration and mobility requests based on foreign PLMN identifiers,

  • maintains a database mapping of PLMN identifiers and types (GUTI, SUCI, or both) to a specific action (allow or reject), and

  • supports wildcard entries to enable default or comprehensive handling of unknown or unlisted PLMN combinations.

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

Foreign PLMN GUTI and SUCI management

2026.04.0

This feature lets you control network access by allowing or rejecting registration requests from foreign PLMNs based on GUTI or SUCI identifiers. You can configure rules to process or block these requests, including handling unknown PLMNs with wildcard entries for better flexibility.

Command introduced:

amf-services foreign-plmn-mgmt-db db_name{ plmn mcc { mcc_value | any } mnc { mnc_value | any } [ suci { allow | reject } ] [ guti { allow | reject } ] } — Used to configure the PLMN entry for the foreign PLMN management database.

Default Setting: Disabled – Configuration Required

Key behaviors and configuration details for AMF foreign PLMN GUTI and SUCI management

The following list describes supported behaviors and configuration capabilities:

  • The AMF can be configured to allow or reject initial and mobility registration requests from a foreign PLMN GUTI.

  • The AMF can be configured to allow or reject initial registration requests from a foreign PLMN SUCI.

  • The database supports up to 50 entries, each matching specific MCC/MNC, type, and action.

  • If no database entry matches, the default behavior is to allow foreign PLMN combinations.

The following ordered list describes the registration reject messages and their corresponding cause codes:

  1. Reject (Registration Request with foreign GUTI): The AMF immediately rejects the request with cause code 9 (UE Identity cannot be derived by the network) and does not perform peer discovery.

  2. Reject (Registration Request with foreign SUCI): The AMF rejects the request with "PLMN not allowed."

The following item-description list summarizes key parameters for each database entry:

  • PLMN: Specifies mcc <MCC> and mnc <MNC> matching criteria

  • Type: Specifies identifier type (guti, suci)

  • Action: Specifies allow or reject and determines request disposition

Configure a foreign PLMN management database

To configure a foreign PLMN management database and associate it with an AMF service.

Procedure

Step 1

Enter configuration mode and create a foreign PLMN management database.

foreign-plmn-mgmt-db db_name

foreign-plmn-mgmt-db db_name : specifies the name of the foreign PLMN management database.

Step 2

Add a foreign PLMN entry to the database.

plmn mcc { mcc_value | any } mnc { mnc_value | any } [ suci { allow | reject } ] [ guti { allow | reject } ]

  • mcc mcc_value : Specifies the MCC to match. Enter exactly three decimal digits or any.

  • mnc mnc_value : Specifies the MNC to match. Enter exactly two or three decimal digits or any.

  • suci allow : Allows requests containing a SUCI.

  • suci reject : Rejects requests containing a SUCI.

  • guti allow : Allows requests containing a GUTI.

  • guti reject : Rejects requests containing a GUTI.

Configure at least one SUCI or GUTI action. The SUCI and GUTI actions are independent. If you omit an action, the deafault value is allow.

Step 3

To configure the foreign PLMN entries with different matching criteria:

plmn mcc any mnc any suci allow guti allow
plmn mcc 456 mnc any suci allow guti allow
plmn mcc 456 mnc 123 suci reject guti reject

When multiple entries match a foreign PLMN, the AMF selects the most specific valid entry in the following order:

  1. Exact MCC and exact MNC

  2. Exact MCC and any MNC

  3. Any MCC and any MNC

  4. If no entry matches, the default action is allow.

For a UE with PLMN 456-123, the AMF selects the exact MCC and MNC entry and rejects requests containing either a SUCI or GUTI. The AMF selects this entry regardless of the order in which the entries are configured.

Two-digit and three-digit MNC values are distinct. For example, MNC 01 does not match MNC 001.

Step 4

Optional: Configure wildcard rules by using the any keyword.

Use a specific MCC with any as the MNC value: 

plmn mcc 123 mnc any suci allow guti allow

Use any for both the MCC and MNC values: 

plmn mcc any mnc any suci reject guti reject

Step 5

Save and exit the foreign PLMN management database configuration.

Step 6

Associate the foreign PLMN management database with an AMF service.

amf-service service_name 
            foreign-plmn-mgmt-db db_name 
               end

  • amf-service service_name : specifies the name of the AMF service.

  • foreign-plmn-mgmt-db db_name : specifies the foreign PLMN management database to associate with the AMF service.